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We claim: 

1 . A method of producing protocol knowledge of the structure of a protocol data 
unit for use in the analysis of network frame traffic, comprising: 

defining the data structure of a set of fields in a protocol data unit in a set 
of keywords; 

associating each of the set of keywords describing the data structure of 
the set of fields in a protocol data unit with a corresponding table of a set of 
tables, each of the tables having a set of data structure fields; 

linking each of the tables in the protocol data unit with one another; and 
generating field code for each of the tables for use in providing protocol 
knowledge of the data structure of each of the fields of the protocol data unit. 

2. The method of claim 1 wherein the data structure is an offset and the set of 
data structure fields is an offset field. 

3. The method of claim 1 wherein the data structure is offset and length and the 
set of data structure fields is an offset field and a length field. 

4. Apparatus including a code generation system for producing protocol 
knowledge of the structure of a protocol data unit for use in the analysis of network 
frame traffic, the apparatus comprising: 

a memory device; 
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a protocol definition language for defining the data structure of a 
set of fields in a protocol data unit in a set of keywords; 

a parser connected to the protocol definition language and the 
memory device for associating each of the set of keywords describing 
the data structure of the set fields in a protocol data unit with 
corresponding table of a set of tables, each of the tables having a set of 
data structure fields; and 

a code generator connected to the parser for generating field code 
for each of the field tables for use in providing protocol knowledge of the 
data structure of each of the fields of the protocol data unit. 

5. The apparatus of claim 4 wherein the data structure is an offset and the set 
of data structure fields is an offset field. 

6. The apparatus of claim 4 wherein the data structure is offset and length and 
the set of data structure fields is an offset field and a length field. 

7. Apparatus for producing protocol knowledge of the structure of a protocol 
data unit for use in the analysis of network frame traffic, comprising: 

means for defining the data structure of a set of fields in a protocol data 
unit in a set of keywords; 
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means for associating each of the set of keywords describing the data 
structure of the set of fields in a protocol data unit with a corresponding table of 
a set of tables, each of the tables having a set of data structure fields; 

means for linking each of the tables in the protocol data unit with one 
another; and 

means for generating field code for each of the tables for use in providing 
protocol knowledge of the data structure of each of the fields of the protocol 
data unit. 

8. The apparatus of claim 7 wherein the data structure is an offset and the set 
of data structure fields is an offset field. 

9. The apparatus of claim 7 wherein the data structure is offset and length and 
the set of data structure fields is an offset field and a length field. 

10. A computer-readable medium whose contents cause a computer system to 
produce protocol knowledge of the structure of a protocol data unit for use in the 
analysis of network frame traffic, by a method comprising: 

defining the data structure of a set of fields in a protocol data unit in a set 
of keywords; 

associating each of the set of keywords describing the data structure of 
the set of fields in a protocol data unit with a corresponding table of a set of 
tables, each of the tables having a set of data structure fields; 
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linking each of the tables in the protocol data unit with one another; and 
generating field code for each of the tables for use in providing protocol 
knowledge of the data structure of each of the fields of the protocol data unit. 

1 1 . The computer-readable medium of claim 10 wherein the data structure is an 
offset and the set of data structure fields is an offset field. 

12. The computer-readable medium of claim 10 wherein the data structure is 
offset and length and the set of data structure fields is an offset field and a length field. 

13. A computer-readable memory system having a protocol definition language 
database stored therein, the protocol definition language database containing a set of 
tables defining the data structure of the fields in a protocol data unit, each of the set of 
tables having a set of data structure fields representing the data structure that a 
particular one of the fields may express, the particular one of the fields being 
associated with a particular one of the tables. 

14. The computer-readable memory system of claim 13 wherein the data 
structure is an offset and the set of data structure fields is an offset field. 

15. The computer-readable memory system of claim 13 wherein the data 
structure is offset and length and the set of data structure fields is an offset field and a 
length field. 
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